The present invention relates to a single software application acting as both the sender and recipient of a message sent over a single network channel.
Computerized communication, whether it occurs at the application level or at the network level, generally involves the exchange of data or messages in a known, structured format (a “protocol”). Software applications and hardware devices that rely on these formats can be vulnerable to various attacks that are generally known as “protocol abuse.” Protocol abuse consists of sending messages that are invalid or malformed with respect to a particular protocol (“protocol anomalies”) or sending messages that are well-formed but inappropriate based on a system's state. Messages whose purpose is to attack a system are commonly known as malicious network traffic.
A proactive solution to the attack problem is to analyze a system ahead of time to discover or identify any vulnerabilities. This way, the vulnerabilities can be addressed before the system is deployed or released to customers. This process, which is known as “security analysis,” can be performed using various methodologies. One methodology for analyzing the security of a device-under-analysis (DUA) is to treat the DUA as a black box. Under this methodology, the DUA is analyzed via the interfaces that it presents to the outside world. For example, one or more messages are sent to the DUA, and the DUA responds by generating one or more messages in return.
The sent messages and return messages can be analyzed to determine whether the DUA operated correctly. Usually, a pair of messages is considered, where the first message (or test message) was received by the DUA and the second message (or response message) was generated by the DUA in response to the first message. Depending on the type of DUA, the second message might be identical to the first message, similar to the first message, or radically different from the first message. For example, if the DUA is a switch, bridge, or router, it might merely relay the first message without modifying it. If the DUA is an anti-virus gateway, it might modify the first message by quarantining and removing an attachment that contains a virus. If the DUA is a decryption device, it might generate a decrypted message (the second message) based on the encrypted message that it received (the first message).
However, before the pair of messages can be analyzed, the correct response message must be matched up with the correct test message. If the analysis is automated, a large number of messages may be sent to the DUA during a short period of time, with the DUA generating an equally large number of messages in responses. It may not be obvious which of the response messages was generated in response to which of the test messages. If one device or devices generate the test messages and another device or devices receive the response messages, some method to synchronize the sending devices and receiving devices is usually required so that response messages can be matched up with the corresponding test messages. However, the synchronization requirement can add complexity and cost to the overall system.
Therefore, there is a need for security analysis approaches that can test pass-through devices, and match test and response messages, in a more efficient manner.